General

  • Target

    7bd0e6587f775e43168da5da5b88134a302c77a9a41f9725f069c282a6e0c7bd

  • Size

    658KB

  • Sample

    241109-x4tmcazhrh

  • MD5

    de36f572128e3be12b7ec9942cb3634c

  • SHA1

    3988eda08fc758ab14a04f16aa6596a69ca03194

  • SHA256

    7bd0e6587f775e43168da5da5b88134a302c77a9a41f9725f069c282a6e0c7bd

  • SHA512

    f11773c16425622fcb9c80a7bfdfb197dac7556ab78e78e64979c6a64598b063cc99da69430eefa0a988a538e0308c9802c2801ccf87ad9ed143ec1c9fd1b5b5

  • SSDEEP

    12288:yMrmy90KrqW0cnszm2twZu8TyhZTM0Lt8TyBB/T44QzWKIS8vWcKx6:gyJrqWtnszm2twZubZg0hp//s4ZKqKx6

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Targets

    • Target

      7bd0e6587f775e43168da5da5b88134a302c77a9a41f9725f069c282a6e0c7bd

    • Size

      658KB

    • MD5

      de36f572128e3be12b7ec9942cb3634c

    • SHA1

      3988eda08fc758ab14a04f16aa6596a69ca03194

    • SHA256

      7bd0e6587f775e43168da5da5b88134a302c77a9a41f9725f069c282a6e0c7bd

    • SHA512

      f11773c16425622fcb9c80a7bfdfb197dac7556ab78e78e64979c6a64598b063cc99da69430eefa0a988a538e0308c9802c2801ccf87ad9ed143ec1c9fd1b5b5

    • SSDEEP

      12288:yMrmy90KrqW0cnszm2twZu8TyhZTM0Lt8TyBB/T44QzWKIS8vWcKx6:gyJrqWtnszm2twZubZg0hp//s4ZKqKx6

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks